CVE-2021-27085 is a remote code execution vulnerability in Microsoft Internet Explorer. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.
What CVE-2021-27085 Means in Practice
CVE-2021-27085 is a remote code execution flaw in Microsoft Internet Explorer. In practical terms, this means untrusted content can trigger code execution inside the browser context, turning a browsing session into a potential initial access path.
Internet Explorer vulnerabilities are especially dangerous because browsers sit at the boundary between external content and local execution. Even when organisations have migrated away from IE as a primary browser, legacy dependencies, embedded rendering components and compatibility modes can keep exposure alive in places that are easy to miss.
Why This Kind of Browser RCE Is Dangerous
Remote code execution in a browser is high impact because it can convert a single malicious page or delivered file into foothold on the endpoint. From there, attackers may move toward credential theft, persistence, lateral movement or further payload delivery depending on the surrounding controls.
The danger is amplified when the vulnerable browser is still permitted on managed desktops or is reachable through legacy enterprise workflows. The most important question is not only whether Internet Explorer is installed, but whether any asset can still invoke its engine, open attacker-controlled content or process web content in a legacy context.
For the authoritative record and version guidance, use the CVE Program entry and the NIST National Vulnerability Database rather than relying on summaries alone.
How Organisations Check Exposure and Reduce Attack Surface
Exposure assessment starts with asset inventory. Teams should identify where Internet Explorer remains installed, where its components are enabled, and which systems still depend on IE mode, legacy automation or web applications that only work in that browser family.
Because this CVE was added to CISA’s Known Exploited Vulnerabilities catalogue, organisations should treat it as a live remediation priority and compare their environment against the vendor advisory and KEV status. The key operational task is to determine which endpoints are actually reachable by the vulnerable code path, not just which systems appear to have the browser present.
Compensating controls matter when patching is delayed. Restricting the browser’s use, disabling unnecessary legacy access paths, tightening application allow lists and reducing exposure to untrusted web content all help lower the chance that the flaw can be triggered before remediation is complete.
Detection, Remediation, and Post-Exploitation Review
After patching or mitigation, organisations should review for signs that the vulnerability was already exploited. Browser RCE often leaves few obvious indicators at first, so investigation should focus on endpoint telemetry, unusual child processes, suspicious script activity, unexpected downloads and evidence that the browser was used to launch secondary payloads.
Post-patch review is important because fixing the vulnerability does not automatically remove any foothold gained before remediation. If exploitation is suspected, treat the endpoint as potentially compromised and verify whether tokens, cached sessions, saved credentials or service access were exposed through the initial execution path.
When a browser exploit is used as the first stage of compromise, the business impact is often broader than the browser itself. A successful review should therefore ask whether the incident stayed local to the workstation or became an entry point into broader identity, email, file access or administrative activity.
Risk and Threat Considerations
Browser RCE creates a direct attacker path from content delivery to local execution, which makes it attractive for phishing, drive-by compromise and delivery of follow-on malware. In environments where Internet Explorer remains reachable, the weakness can silently preserve an old attack surface inside otherwise modern estates.
Failure mechanism: A malicious page, embedded object or delivered content triggers the vulnerable Internet Explorer code path and executes attacker-controlled code on the endpoint.
Impact: The attacker can gain initial code execution, install payloads, steal data or credentials, and use the compromised machine as a launch point for broader intrusion activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE demands rapid identification and remediation of an actively exploited flaw. |
| Recommendation — Prioritise and remediate the Internet Explorer RCE using continuous vulnerability management workflows. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and devices are monitored to find anomalies and events | Post-exploitation review depends on monitoring endpoint and browser activity for signs of abuse. |
| Recommendation — Monitor endpoints for suspicious browser activity, child processes and post-exploit behaviour. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The subject is an exploited software flaw that requires timely remediation and verification. |
| SI-4 — System Monitoring | Detection of exploitation requires endpoint and process monitoring after remediation. | |
| Recommendation — Patch or mitigate the browser flaw and verify the vulnerable code path is no longer reachable. Use system monitoring to detect browser exploitation attempts and follow-on payload activity. | ||
| MITRE ATT&CK | T1203 — Exploitation for Client Execution | Browser RCE is a classic client-side exploitation technique used to execute attacker code. |
| Recommendation — Map the exploit to client-side execution and hunt for related follow-on behaviours. | ||
Practitioner Guidance
Why practitioners should care: Treat this as more than a browser bug, because legacy browser exposure often persists through compatibility dependencies that are easy to overlook. The practical decision is whether the organisation can remove, contain or strictly limit the last remaining Internet Explorer execution paths.
Common misunderstanding: Many teams assume that retiring Internet Explorer as a default browser is enough. In reality, the risk can remain wherever rendering components, legacy applications or compatibility settings still allow the vulnerable code to be invoked.
Practitioner takeaway: Prioritise endpoint discovery, confirm where Internet Explorer functionality still exists, and validate that remediation has closed the exact execution path that attackers could abuse.